Re: [rtcweb] JSEP fingerprint hash requirements

[Martin Thomson <[e-mail]>]

On 21 October 2013 16:57, Justin Uberti <[e-mail]> wrote:
> Lacking anything else to point at, I changed the text in jsep-05 to just
> reiterate the policy from 4572.

Probably sensible, even if 4572 falls short.

> However, it does raise the larger question of what digest (and perhaps key
> length) should be used when generating certificates in WebRTC, and where
> that should be specified.

The main factors that affect WebRTC are the size of the RSA modulus
(if we're still doing that) and the digest function used for identity
validation.  The first is largely a unilateral decision, once we sort
out whether we want RSA or RSA + DH or one of the EC options.
Currently, there is no way to get hash agility with the mechanism
defined in security-arch, a problem I think we should discuss.

--Martin